New York SBDC Research Network

From the Internal Revenue Service : The Internal Revenue Service, state tax agencies and the tax industry will hold a National Tax Security Awareness Week December 3-7, 2018 to encourage individual and business taxpayers to take steps to protect their tax data and identities in advance of the 2019 filing season. The IRS announced steep declines in tax-related identity theft in 2017 following the success of the Security Summit effort. Key indicators of identity theft dropped for the second year in a row in 2017. This includes a 40 percent decline in taxpayers reporting they are victims of identity theft in 2016. Since 2015, the number of tax-related identity theft victims has fallen by almost two-thirds and billions of dollars of taxpayer refunds have been protected. The Don't Take the Bait awareness series is focused on the need for tax professionals to increase their computer security and be cautious of spear phishing scams. Tax professionals must remember that they have a l

Obtained from: eMarketer If a deal seems too good to be true, it probably is. Online buying scams were the biggest type of consumer fraud in 2017, according to the Better Business Bureau's (BBB's) annual scam-tracking report—up from fourth place a year earlier. The rise of digital shopping and growing comfort with sharing personal information online are factors in this growing category of fraud. At its most basic, consumers pay for something they never receive, which according to the BBB involves pets and clothing more than other types of online purchases. Most cases involve credit card payments. The report broke down susceptibility and loss by age, and very clear patterns emerged.

From PR Newswire : Over 90% of large US companies with 500+ employees have a cybersecurity policy in place to protect them from both real and anticipated threats, according to a new survey from Clutch, a leading B2B ratings and reviews firm. Clutch surveyed over 300 corporate IT decision-makers about what to include in a cybersecurity policy and found that security software, data backup and storage, and scam detection are the most common areas cybersecurity policies cover. Phishing attacks are the cybersecurity attack large companies most commonly experience: 57% of IT decision-makers said their company experienced a phishing attack in the past year. Over 80% of IT decision-makers surveyed say they proactively communicate their company's cybersecurity policy, policy compliance, and training to employees. However, only two-thirds (66%) of these decision-makers enforce their company's cybersecurity policy.

WannaCry: What can you do to protect your business? By Matthew Wall and Mark Ward Technology of Business, BBC News 19 May 2017   From the section Business There's been a lot in the news over the past week or two about the WannaCry cyber-attacks and what companies, in particular, are doing about the risk.   As well as keeping antivirus, firewall, application and OS software up-to-date, backing up key data regularly to offline hard drives should be a top priority, most cyber experts agree. This is because  data breaches and cyber-attacks  are inevitable these days. The bad news is that the average cost of a data breach globally stands at $4m (£3.1m), according to SailPoint, an identity management firm. This article from the BBC discusses what attacks mean for business and what steps can be taken.                       And this from Department of Homeland Security for what to do before, during and after: Cyber Incident  ... ·      

Re-posted from the NYS Enterprise Information Security Office 's March 2017 Newsletter.   View more of their great newsletter topics here .  From the Desk of Thomas F. Duffy, Chair Day in and day out, employees hear the same things from their IT staff about cybersecurity and safety. Though they may sound like a broken record, there are very important reasons and rationale behind these practices and advice. Keeping safe and secure while connected isn't just about how your system is set up - it is also very much about how you end up using it. Below, we discuss some common IT staff wisdom and provide some background information and the rationale as to why it definitely merits your attention.   Make sure you lock your screen when you are away from your desk: Screen locking policies exist for a reason. Even if you are leaving for just a few minutes at a time, be sure to lock your screen. Though physical intruders are rare during daytime and in conventionally sec

From Verizon : Every year, the Verizon RISK (Research, Investigations, Knowledge, Solutions) Team investigates hundreds of cybercrimes and helps organizations recover fast. In the Data Breach Digest, we share some of our most interesting cases—anonymized of course—so you can learn from the lessons of others. Our 16 cybercrime case studies cover the most lethal and prevalent threats you face—from partner misuse to sophisticated malware. We set out the measures you can take to better defend your organization and respond quickly if you are a victim of an attack. A cyber attack isn’t just a problem for IT. The fallout can affect every part of your organization—from Legal Counsel to Human Resources and Corporate Communications. To reflect that, each of the cybercrime case studies is written from the viewpoint of a different stakeholder. That will help you understand the critical pivot points in an investigation and the kind of decisions you might be faced with if you’re a data breach

From the IRS : In an unprecedented partnership, the IRS, the states and the tax industry are working together to protect your federal and state tax accounts from identity thieves. We are asking you - taxpayers, tax preparers and businesses - to join with us to create an even stronger partnership in the face of this constantly evolving enemy. Our "Taxes. Security. Together" awareness campaign is an effort to better inform you about the need to protect your personal, tax and financial data online and at home. People continue to fall prey to clever cybercriminals who trick them into giving up Social Security numbers, account numbers or password information. In turn, criminals use this information a variety of ways, including filing fraudulent tax returns. As part of the "Taxes. Security. Together" effort, we launched a Protect your Clients; Protect Yourself campaign to raise awareness among tax professionals that they increasingly are targets of cybercriminals an

The U.S. House of Representatives passed the Improving Small Business Cyber Security Act of 2016 this week, to help small businesses protect themselves from cyberattacks. A companion bill is still working its way through the Senate. The bill, sponsored by Rep. Richard Hanna (R-NY), Chairman of the House Small Business Committee was approved by voice vote on a bipartisan basis. Here are the main nuggets from that press release : American small businesses are under cyberattack like never before. By one estimate, 71 percent of cyberattacks occurred in businesses with fewer than 100 employees. With America’s 28 million small businesses making up 54 percent of annual sales in the U.S., the frequency of such attacks and the high costs they create for small businesses could have ripple effects throughout our economy. Small businesses are often not prepared to prevent cyberattacks or easily recover from the damages of successful intrusions. A report by Internet security firm McAfe

From SBA 1.) Protect against viruses, spyware, and other malicious code, Make sure each of your business’s computers are equipped with antivirus software and antispyware and update regularly. Such software is readily available online from a variety of vendors. All software vendors regularly provide patches and updates to their products to correct security problems and improve functionality. Configure all software to install updates automatically. 2.) Secure your networks,  Safeguard your Internet connection by using a firewall and encrypting information. If you have a Wi-Fi network, make sure it is secure and hidden. To hide your Wi-Fi network, set up your wireless access point or router so it does not broadcast the network name, known as the Service Set Identifier (SSID). Password protect access to the router.

The U.S. Small Business Administration unveiled today a new cybersecurity webpage for small businesses at  www.sba.gov/cybersecurity  on the 12th Anniversary of National Cybersecurity Awareness Month.  The SBA launched the online tools and resources to highlight Cybersecurity at Work from October 5-9th and in recognition of President Obama’s annual proclamation to educate Americans about cyberthreats and cybersafety. “Cybersecurity is one of our nation’s most pressing national security priorities, and America’s 28 million small businesses, which create two out of every three new jobs in the U.S., are especially at risk.  Small employers are quickly becoming a larger target for criminals looking to access sensitive data because small businesses typically have limited resources for information systems security,” 

This self-paced training exercise provides an introduction to securing information in a small business. Topics include: Defining cybersecurity; Explaining the importance of securing information through best cybersecurity practices; Identifying types of information that should be secured; Identifying the types of cyber threats; Defining risk management; and Listing best practices for guarding against cyber threats. Duration: 30 minutes Take the course HERE .